Chapter 2 of 5 · ISC2 CC
Security Governance
Governance, risk and compliance planning, business continuity and disaster recovery, security awareness and measuring effectiveness.
- 3topics
- 9 minfast track
- 17.3%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Governance, Risk and ComplianceWhat governance, risk and compliance (GRC) is, why it matters, the frameworks and tools that support it, and how GRC applies to…3 min
- 2Business Continuity and Disaster RecoveryRedundancy for the CC exam: business continuity and disaster recovery plans, the BIA, RTO and RPO, backups, failover, load…3 min
- 3Security Awareness and Measuring EffectivenessSecurity culture, social engineering, phishing and password protection, AI-era awareness, and measuring security with metrics…3 min
About this chapter
What this chapter covers
Security Governance is worth about 17 percent of the CC exam. It looks at how an organization plans and runs its security program: bringing governance, risk and compliance together, staying operational through disruptions, building a security-aware culture and proving that security is working.
It covers governance, risk and compliance (GRC) (purpose, importance, frameworks and tools), redundancy (business continuity and disaster recovery), security awareness (organizational culture, social engineering, password protection and phishing) and measuring cybersecurity effectiveness (key metrics, key risk indicators, dashboards, scorecards and reports). The 2026 outline adds AI themes such as AI-written phishing, backing up models and data, model drift and AI risk indicators.
How the topics fit together
CC questions in this domain ask what a program element is for, which plan covers which situation, and which measure best shows whether security is working.
Business continuity keeps the business running; disaster recovery restores IT systems. Many questions turn on that difference.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.